A new variation of the ClickFix attack called ‘ConsentFix’ exploits the Azure CLI OAuth app to hijack Microsoft accounts without passwords or MFA. It manipulates users through sophisticated phishing webpages to steal OAuth authorization codes, granting attackers full account access. #ClickFix #ConsentFix #AzureCLI #OAuth2 #MicrosoftAccounts
Category: Cyber Security News
Robotic Process Automation (RPA) enhances organizational efficiency and security by automating repetitive tasks and managing bot identities within Identity and Access Management (IAM). Organizations must address challenges like bot management, expanded attack surfaces, and integration issues to secure RPA deployments effectively. #RPA #IAM #ZeroTrust #PrivilegedAccessManagement #SecretsManagement…
Cybersecurity researchers have identified NANOREMOTE, a new Windows backdoor that uses the Google Drive API for covert command-and-control activities. It shares code similarities with the FINALDRAFT malware, attributed to the REF7707 Chinese threat cluster targeting sectors across Southeast Asia and South America. #NANOREMOTE #FINALDRAFT #REF7707…
This week’s cyber stories highlight the rapid evolution of digital threats, from malware in movie downloads to sophisticated botnets exploiting system vulnerabilities. The Threatsday Bulletin provides a concise overview of major security incidents and emerging risks in the cyber landscape. #Mirai #LummaStealer…
LastPass, a password management company, was fined £1.2 million by the UK ICO after a 2022 data breach that exposed personal information of up to 1.6 million users. The incident involved hacker access through stolen credentials, highlighting weaknesses in LastPass’s security measures. #LastPass #ICO #DataBreach #CredentialTheft…
A data breach at Pierce County Library System compromised the personal information of over 340,000 individuals, including patrons and employees. The library is offering a year of free credit monitoring and identity protection services, but the threat actors responsible remain unidentified. #DataBreach #PierceCountyLibrarySystem…
MITRE’s 2025 ATT&CK Evaluations assess cybersecurity solutions’ effectiveness against real-world cyberattack scenarios, including cloud-based threats and reconnaissance detection. Several companies reported achieving 100% detection rates, highlighting advancements in threat protection. #MITRE #ATTACKEvaluations #CybersecuritySolutions #CloudSecurity #ThreatDetection…
A former senior manager at a government contractor has been charged with lying about security compliance for a cloud platform used in federal contracts. The case highlights ongoing issues of cybersecurity fraud and the importance of adherence to federal security standards. #FedRAMP #DepartmentofDefense…
India’s Central Bureau of Investigation has charged 13 individuals involved in a “Digital Arrest” cyber fraud ring with cross-border links to Southeast Asia, including cyber slave compounds in Myanmar. This operation highlights the interplay between transnational cybercrime, human trafficking, and organized fraud, with efforts ongoing to dismantle these networks. #DigitalArrest #OperationChakraV…
Petco’s Vetco Clinics website experienced a data leak exposing sensitive customer and pet information due to a security vulnerability. The incident highlights ongoing cybersecurity issues within Petco, marking their third breach in 2025. #InsecureObjectReference #VetcoDataLeak…
Cybersecurity researchers have identified a new campaign involving a Python-based delivery chain that deploys the CastleLoader malware family using ClickFix social engineering prompts. The attack employs memory-only payload execution techniques to avoid detection and utilizes PEB Walking for API resolution. #CastleLoader #ClickFix…
Google has issued emergency updates to patch a zero-day vulnerability in Chrome that is actively exploited in the wild, affecting multiple operating systems. Since the beginning of the year, Google has fixed eight zero-day flaws, including recent critical bugs in the LibANGLE library and V8 engine. #ChromeZeroDay #LibANGLE #V8Engine #ThreatActors
Microsoft has addressed multiple bugs in Windows 11 through recent updates, including a white flashing issue in File Explorer’s dark mode and network connectivity problems on virtual machines. These fixes improve system stability, security, and performance for users running Windows 11 with the latest patches. #Windows11 #FileExplorer #KB5070311
Huntress warns about a newly exploited vulnerability in Gladinet’s CentreStack and Triofox products due to hard-coded cryptographic keys, which can lead to remote code execution and data leaks. Organizations using these products should update to the latest version and monitor their logs for specific indicators of compromise. #Gladinet #Triofox #WebConfigExploitation…
Google has released security updates for Chrome to fix three vulnerabilities, including one actively exploited in the wild. The flaws mainly affect Google’s ANGLE library and could lead to memory corruption or arbitrary code execution. #ChromeVulnerabilities #ANGLELibrary…